CISA Certified Information Systems Auditor 2

Question 1

During an IS audit, an auditor discovers that a control is functioning as intended but the risk it mitigates has already been accepted by management. What is the BEST course of action?

Accepted Answer

Document the accepted risk and note the control as redundant in the report

Answer

Report the control as effective and move on

Answer

Recommend removing the control immediately

Answer

Escalate to the board of directors

Question 2

Which of the following BEST describes the purpose of a control self-assessment (CSA)?

Accepted Answer

To allow management and staff to assess controls collaboratively

Answer

To replace the external audit process

Answer

To evaluate only financial controls

Answer

To provide an independent third-party opinion

Question 3

An organization uses a third-party cloud provider for critical data processing. Which audit approach is MOST appropriate to assess the provider's controls?

Accepted Answer

Obtain and evaluate a SOC 2 Type II report

Answer

Review the vendor's marketing materials

Answer

Conduct an on-site audit of every data center

Answer

Rely solely on contractual guarantees

Question 4

When evaluating IT governance, an IS auditor should PRIMARILY focus on whether:

Accepted Answer

IT strategy is aligned with business objectives

Answer

IT systems are using the latest technology

Answer

The IT department has sufficient headcount

Answer

All software licenses are current

Question 5

A residual risk is BEST defined as:

Accepted Answer

Risk that remains after controls have been applied

Answer

Risk that has been fully eliminated by controls

Answer

Risk identified during the initial risk assessment

Answer

Risk transferred to an insurance provider

Question 6

Which sampling technique is MOST appropriate when an auditor wants to give every transaction an equal chance of being selected?

Accepted Answer

Random sampling

Answer

Judgmental sampling

Answer

Stratified sampling

Answer

Haphazard sampling

Question 7

During a post-implementation review of an ERP system, an auditor finds that user acceptance testing (UAT) was skipped. What is the PRIMARY risk?

Accepted Answer

The system may not meet business requirements

Answer

The project exceeded budget

Answer

Vendors may not be paid on time

Answer

IT staff may lack training